.\" Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
.\"
.\" Licensed under the Apache License, Version 2.0 (the
.\" "License"). You may not use this file except in compliance
.\" with the License. A copy of the License is located at
.\"
.\"      http://aws.amazon.com/apache2.0/
.\"
.\" or in the "license" file accompanying this file. This file is
.\" distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
.\" CONDITIONS OF ANY KIND, either express or implied. See the
.\" License for the specific language governing permissions and
.\" limitations under the License.
.TH DOCKER-CREDENTIAL-ECR-LOGIN 1 2018-10-29 AMAZON-WEB-SERVICES AMAZON-ECR
.SH NAME
docker\-credential\-ecr\-login \- Amazon ECR Credential Helper for Docker
.SH SYNOPSIS
.B docker\-credential\-ecr\-login
COMMAND

.B docker\-credential\-ecr\-login
-v
.SH DESCRIPTION
The Amazon ECR Credential Helper for Docker is a credential helper for the
.BR docker (1)
command that makes it easier to store and retrieve container images with Amazon
Elastic Container Registry.
.SH USAGE
Place the
.B docker\-credential\-ecr\-login
binary on your
.IR PATH
and set the contents of your
.IR ~/.docker/config.json
to be

.nf
{
  "credsStore":"ecr-login"
}
.fi

With Docker 1.13.0 or greater, you can configure Docker to use different
credential helpers for different registries.  To use this credential helper for
a specific ECR registry, create a
.IR credsHelper
section with the URI of your ECR registry:

.nf
{
  "credHelpers": {
    "public.ecr.aws": "ecr-login",
    "aws_account_id.dkr.ecr.region.amazonaws.com": "ecr-login"
  }
}
.fi

Once installed, you may use \fIdocker pull\fP and \fIdocker push\fP with ECR
repositories, without running \fIdocker login\fP.
.SH AWS CREDENTIALS
The credential helper reads AWS credentials from standard locations, including
environment variables, the shared credentials file (\fI~/.aws/credentials\fP),
EC2 instance profiles, and ECS task roles.

To use credentials associated with a different named profile in the shared
credentials file, you may set the \fIAWS_PROFILE\fP environment variable.

The credential helper reads and supports some configuration
options specified in the shared configuration file (\fI~/.aws/config\fP).  To
disable these options, you must set the \fIAWS_SDK_LOAD_CONFIG\fP environment
variable to \fIfalse\fP.  The supported options include:
.IP \[bu] 2
Assumed roles specified with \fIrole_arn\fP and \fIsource_profile\fP
.IP \[bu]
External credential processes specified with \fIcredential_process\fP
.IP \[bu]
Web Identities like IAM roles for Service Accounts in Kubernetes

.RE
The credentials must have a policy applied that allows access to Amazon ECR.
See http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html
for more information.
.SH OPTIONS
.TP 16
.BR -v
Print the version and git commit used to build docker\-credential\-ecr\-login
.SH COMMANDS
.TP 16
.BR get
Retrieve credentials for a specific Amazon ECR registry. The registry should be
passed to the credential helper via
.BR stdin (3)
and results will be printed to
.BR stdout (3)
.TP 16
.BR list
Retrieve the names of each registry currently known to the helper. The helper
will cache the names of all requested registries and return them here.
.TP 16
.BR version
Return the version of the credential helper protocol implemented by this helper
.TP 16
.BR store
This command is not implemented and is a no-op.
.TP 16
.BR erase
This command is not implemented and is a no-op.
.SH BUGS
Kubernetes users using the credential helper inside containers with a non-root
user may encounter permission issues described here:
https://github.com/kubernetes-sigs/external-dns/pull/1185.  You may be able to
work around this bug by adjusting the Kubernetes \fIsecurityContext\fP.
.SH COPYRIGHT
Copyright Amazon.com, Inc. or its affiliates.  All rights reserved.
.SH LICENSE
Licensed under the Apache License, version 2.0.

